AWS Config

What is AWS Config?

AWS Config continuously records the configuration of your AWS resources over time and evaluates them against rules to check compliance. It answers questions that are surprisingly hard to answer otherwise: What is the current configuration of this resource? What did it look like last week? What changed, when, and who changed it? Which resources violate our security or compliance policies right now? Config maintains a detailed, timestamped history of resource configurations and their relationships, and lets you define rules that flag resources as compliant or non-compliant (e.g., “every S3 bucket must have encryption enabled,” “no security group may allow unrestricted SSH”). It’s the configuration-audit and drift-detection layer of AWS governance.

What it does and how it fits with other services

Config’s capabilities center on three things. Configuration history and change tracking: it snapshots resource configurations whenever they change, giving you a timeline — invaluable for troubleshooting (“this broke yesterday; what config changed?”) and for security investigations (“when did this resource become publicly accessible, and from what previous state?”). Compliance rules: managed and custom Config Rules continuously evaluate resources against desired configurations, so instead of discovering a misconfigured resource during an annual audit, you get continuous compliance monitoring and can even trigger automatic remediation (a Lambda function that fixes a non-compliant resource). Relationship mapping: Config understands how resources relate (which instances are in which VPC, which security groups attach where), aiding impact analysis. It’s important to distinguish Config from neighbors it’s often confused with: CloudTrail records API calls (who did what action, the audit log of activity), while Config records resource configuration state (what things are, over time) — they’re complementary (CloudTrail tells you an action happened; Config tells you the resulting configuration). And Config’s findings feed into AWS Security Hub, which aggregates compliance and security findings across services into one posture view. Config is the engine behind much of AWS’s continuous-compliance and configuration-governance story.

Where it’s valuable — and the cost caveat

AWS Config is most valuable for governance, compliance, and security at scale: organizations in regulated industries use it to continuously demonstrate that resources meet required configurations (encryption, logging, access restrictions), to detect configuration drift (resources that have diverged from their intended, often IaC-defined state), and to maintain the audit trail auditors demand. In a multi-account setup, Config can aggregate across the whole organization for centralized compliance visibility. The realities to plan for: cost is the big one and a frequent surprise — Config bills based on the number of configuration items recorded and rule evaluations, and in a large, busy environment (many resources changing frequently, many rules) this can add up substantially; the standard mitigation is to scope what Config records (which resource types, which regions) rather than recording everything everywhere, and to be deliberate about rule count — recording every resource type across every region “just in case” is the path to an unexpectedly large bill. As with all compliance tooling, Config’s value is realized only when its findings drive action: non-compliance findings that nobody remediates (or automated remediation that’s never set up) reduce risk by nothing. The recurring mistakes: confusing Config with CloudTrail (they record different things), enabling unscoped recording across all resource types and regions without regard to cost, and treating compliance findings as a dashboard rather than wiring them into remediation.

What people get wrong

• Confusing it with CloudTrail — CloudTrail logs API activity (who did what); Config records resource configuration state over time; they’re complementary, not interchangeable.
• Unscoped recording: recording every resource type in every region drives Config’s per-item and per-evaluation costs up fast — scope it to what you actually need to govern.
• Findings without remediation — continuous compliance only reduces risk if non-compliant resources get fixed (manually or via automated remediation); a compliance dashboard alone changes nothing.

Primary source: AWS Config documentation